On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.
 
 

Tim got into cyber through the military. From the military he went into consulting and ended up at JetBlue. At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on. Along with that, he strives to keep his team motivated and moving forward.
 
 

Agile is a software programming methodology, and it replaced Waterfall. Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.
 
 

Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics. Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'. QA is very rapid as well, leading to rapid release. Agile is characterized by daily 'standup meetings' where literally nobody sits in an effort to keep the meetings as short as possible.
 
 

In Agile, product owners come up with ideas and thread those through marketing and development. In appplying this paradigm to running a security teamm, Tim replaces product owners with threat intelligence folks.
 
 

This unique approach towards managing a security program means that all decisions are threat-informed, and that small incremental wins are a constant.
 
 

But Tim does not stop there. Anyone on the team can create and manage a story to address any specific and immediate security need...
 
 

Key Takeaways
 
 

1:10 Tim’s background and day job
 

2:08 JetBlue
 

2:39 Introduction of Agile
 

3:57 Tim’s approach
 

6:15 How Agile is used
 

8:31 Threats addressed
 

9:46 Story sourcing
 

11:03 Creating the story
 

12:48 Narrative skill
 

14:08 Metrics
 

15:53 Risk management aspect
 

19:00 Not using risk
 

21:38 Positives
 

23:20 What keeps Tim going in cyber
 

24:42 What Tim is looking forward to in cyber
 
 

Links:
 
 

Learn more about Tim on <a href='https://www.linkedin.com/in/timrohrbaugh/'>LinkedIn</a> 

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a> 

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a> 

Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.



Tim got into cyber through the military. From the military he went into consulting and ended up at JetBlue. At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on. Along with that, he strives to keep his team motivated and moving forward.



Agile is a software programming methodology, and it replaced Waterfall. Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.



Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics. Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'. QA is very rapid as well, leading to rapid release. Agile is characterized by daily 'standup meetings' where literally nobody sits in an effort to keep the meetings as short as possible.



In Agile, product owners come up with ideas and thread those through marketing and development. In appplying this paradigm to running a security teamm, Tim replaces product owners with threat intelligence folks.



This unique approach towards managing a security program means that all decisions are threat-informed, and that small incremental wins are a constant.



But Tim does not stop there. Anyone on the team can create and manage a story to address any specific and immediate security need...



Key Takeaways



1:10 Tim’s background and day job


2:08 JetBlue


2:39 Introduction of Agile


3:57 Tim’s approach


6:15 How Agile is used


8:31 Threats addressed


9:46 Story sourcing


11:03 Creating the story


12:48 Narrative skill


14:08 Metrics


15:53 Risk management aspect


19:00 Not using risk


21:38 Positives


23:20 What keeps Tim going in cyber


24:42 What Tim is looking forward to in cyber



Links:



Learn more about Tim on <a href='https://www.linkedin.com/in/timrohrbaugh/'>LinkedIn</a>

Follow <a href='https://allanalford.com/'>Allan Alford</a> on <a href='https://linkedin.com/in/allanalford'>LinkedIn</a> and <a href='https://twitter.com/AllanAlfordinTX'>Twitter</a>

Learn more about <a href='https://hackervalley.com/'>Hacker Valley Studio</a> and <a href='https://hackervalley.com/cyberranch'>The Cyber Ranch Podcast</a>

Sponsored by our good friends at <a href='https://attackiq.com/'>AttackIQ</a>

On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.

Tim got into cyber through the military.  From the military he went into consulting ...

On today’s episode with Allan, we have Tim Rohrbaugh, CISO at JetBlue, here to talk about Agile methodology and how it can be applied to an entire security program.

Tim got into cyber through the military.  From the military he went into consulting and ended up at JetBlue.  At JetBlue that he is always trying to find ways to invest dollars in security programs to balance what is going on.  Along with that, he strives to keep his team motivated and moving forward.

Agile is a software programming methodology, and it replaced Waterfall.  Waterfall was the traditional model of development, where large chunks of code had to flow from developers to QA, back to developers several times, and finally to release.

Agile, on the other hand, works off user-centric stories, which roll up to bigger stories called epics.  Stories are small, discrete goals, met with smaller, discrete chunks of code released in what are called 'sprints'.  QA is very rapid as well, leading to rapid release.  Agile is characterized by daily 'standup meetings' where literally nobody sits in an effort to keep the meetings as short as possible.

In Agile, product owners come up with ideas and thread those through marketing and development.  In appplying this paradigm to running a security teamm, Tim replaces product owners with threat intelligence folks.

This unique approach towards managing a security program means that all decisions are threat-informed, and that small incremental wins are a constant.

But Tim does not stop there.  Anyone on the team can create and manage a story to address any specific and immediate security need...

Key Takeaways

1:10 Tim’s background and day job

2:08 JetBlue

2:39 Introduction of Agile

3:57 Tim’s approach

6:15 How Agile is used

8:31 Threats addressed

9:46 Story sourcing

11:03 Creating the story

12:48 Narrative skill

14:08 Metrics

15:53 Risk management aspect

19:00 Not using risk

21:38 Positives

23:20 What keeps Tim going in cyber

24:42 What Tim is looking forward to in cyber

Links:

Learn more about Tim on LinkedIn
Follow Allan Alford on LinkedIn and Twitter
Learn more about Hacker Valley Studio and The Cyber Ranch Podcast
Sponsored by our good friends at AttackIQ

Agile for Security Programs w/ Tim Rohrbaugh

Apple

Google

Spotify

Amazon

Ride the cyber trails with one CISO (Allan Alford) and a diverse group of friends and experts who bring a human perspective to cybersecurity.